Identification authentication methods and systems

Abstract

Identification authentication methods and systems are provided. In accordance with some embodiments, a user can verify or authenticate an item to ensure if the item is authentic by utilizing a security token. For example, a user can authenticate a website to determine if the website is authentic by providing information to decrypt a security token, and the user can determine if the website is authentic by reviewing the decrypted security token. An authentication method between a user and a service provider can comprise generating a security token, presenting the security token to a user, decrypting the security token, and receiving user information to authenticate a user. The security token can based at least partially on user information, and can comprise encrypted token information. Decrypting the security token can occur dynamically in real time so the token information appears enabling a user to authenticate a service provider. Other embodiments are also claimed and described.

Description

CROSS-REFERENCE TO RELATED APPLICATION [0001] This application claims the benefit of U.S. Provisional Application No. 60 / 656,843 filed 25 Feb. 2005, which is incorporated herein by reference in its entirety as if fully set forth below.TECHNICAL FIELD [0002] The various embodiments of the present invention relate generally to internet and computer network security, and more particularly, to devices, methods, and systems that provide identification authentication between users and devices in a computer network. BACKGROUND [0003] Proliferation of the Internet has brought on unprecedented access to sales and services. Unfortunately, however, the Internet's growth has also created new opportunities for scam artists and others who seek to use fraudulent business schemes for ill-gotten gains. In the traditional business world, people do not hand over personal and financial information to strangers without verification. While real world verification can be easily accomplished due to persona...

AI Technical Summary

Benefits of technology

[0009] The various embodiments of the present invention provide a straightforward identification authentication technology that leverages existing infrastructure. Embodiments of the present invention provide technology that builds upon and improves the known conventional username-password method, and adds a token confirmation for users to verify positively the identity of a service provider. Indeed, embodiments of the present invention enable customers to be assured of the authenticity of a communication including, but not limited to, a network device, a web service, a website, a text message, or an email.

[0010] Embodiments of the present invention utilize various features to provide identification authentication methods and systems. For example, some embodiments utilize a token, such as a 128 bit AES encrypted token, and cookies are not preferably utilized. Embodiments of the present invention can be implemented with minimal costs and can be utilized with various user environments, such as web services, communications, networked devices, or appliances. Preferably, a token used in some embodiments of the present invention is a dynamic token enabling authentication to occur without using static information. A token can contain any information unique to a user. For example, when authenticating, a token can contain information such as date, time, mutually agreed upon information, location information, or the like. In addition, embodiments of the present invention can be utilized as a stand alone identification verification program or can be used in conjunction with the other authentication technologies. In yet other embodiments, the present invention can be implemented as a hosted solution or operated solely by a service provider.

Problems solved by technology

Unfortunately, however, the Internet's growth has also created new opportunities for scam artists and others who seek to use fraudulent business schemes for ill-gotten gains.

While real world verification can be easily accomplished due to personal, face-to-face transactions, verifying identities in the virtual world remains challenging.

A key issue with virtual authentication is identifying and verifying the identity of who someone is conducting business over a network (e.g., Internet).

On virtual networks it is not so easy.

While these conventional technologies serve their respective purposes, they do have associated drawbacks.

For example, one such drawback includes that static identification methods and cookies are utilized.

Static identification, however, once compromised, can be use to deceive a user, thus defeating the purpose of verifying identification.

In addition, static identification is less desirable because static authentication information provided in an unencrypted communication, such as email, can be sniffed or seen using network tools.

For example, cookies are vulnerable, transparent to users, and can be abused by scammers.

Also, Token Two Factor Authentication users must carry around a token to retrieve a one-time password, which can cause problems if people lose the token.

Further, maintenance and installation costs associated with the Token Two Factor Authentication are high.

Phone confirmation users must always have access to a phone, and phone access can be challenging and inconvenient at times. As for SSL Certificates, they are not desirable because they are difficult to manage, are expensive to purchase from third parties, scale poorly, have secure storage issues, and also have key revocation issues.

Images